Every other triage playbook starts with something concrete: an encrypted file, a beacon callback, a compromised credential alert. This one starts with a feeling. A SOC analyst noticed that someone ran nltest /dclist followed by net group "Domain Admins" /domain from a workstation that belongs to an HR employee. Nothing fired. Nothing is malware. The question is whether a human is doing something they shouldn't be, or an adversary is doing exactly what a human would.

LOTL operators like Volt Typhoon weaponize this ambiguity deliberately. They use no custom tools, no implants, no malware. They authenticate with stolen credentials, run built-in commands for discovery, use native file transfer (SMB, RDP clipboard, certutil) for staging, and maintain access through legitimate remote access methods (RDP, SSH, VPN). The only anomaly is behavioral: this account is doing things this account has never done before.

These are the command sequences that distinguish LOTL intrusions from legitimate administration. No single command is malicious. The sequence, timing, and source context make the case.

1. 1. Establish the account baseline What does this account NORMALLY do? Pull 30-60 days of authentication and process history. What hosts does it log into? What times? What commands does it typically run? The deviation from this baseline is the evidence. An HR user running nltest is the anomaly, not nltest itself. HOST: T1033 User Discovery · Security EID 4624 history by account
2. 2. Check the authentication source Where did this session originate? VPN from a new IP, RDP from an internal host the user doesn't normally touch, SSH from a server that shouldn't initiate sessions. Credential theft via infostealer often manifests as valid creds from an unexpected geolocation or IP range. HOST: T1021.001 RDP · Security EID 4624 source IP analysis
3. 3. Map the discovery command sequence Isolate all commands run by this account/session in the suspicious window. Build the timeline. An admin troubleshooting runs targeted commands with gaps (check one thing, think, check another). An attacker runs a scripted enumeration burst: 6-10 discovery commands in 30-60 seconds, often in alphabetical or playbook order. HOST: Discovery (all techniques) · Sysmon EID 1 timeline by session
4. 4. Check for RMM tool abuse Legitimate Remote Monitoring and Management tools (AnyDesk, TeamViewer, ConnectWise ScreenConnect, Atera, Splashtop) are increasingly used as C2 alternatives. They're signed, trusted, and generate no malware alerts. Check for: RMM tools not in your approved software list, RMM tools installed after the suspicious session started, or RMM tools connecting to accounts not associated with your IT team. Sysmon EID 1: process creation for RMM binaries · EID 3: connections to RMM cloud infra
5. 5. Look for "hands on keyboard" indicators Automated scripts execute commands at machine speed with zero gaps. Interactive operators have human-speed typing with variable gaps. But sophisticated operators script their enumeration too. Better signals: command typos followed by corrections, use of cls/clear between commands (cleaning the screen for readability), and dir/ls browsing through directories exploratorily rather than targeting specific paths. Sysmon EID 1 timestamp analysis · PowerShell ScriptBlock EID 4104
6. 6. Trace file access and data movement LOTL operators use built-in tools for staging: xcopy, robocopy, tar, certutil -encode, PowerShell Compress-Archive, or just copy to a share. They don't need Rclone or MEGAcmd. Check for bulk file operations by the suspect account, especially targeting sensitive directories (finance, HR, executive, engineering). HOST: T1570 Lateral Tool Transfer · Security EID 5145 share access
7. 7. Check for credential escalation without tools LOTL operators escalate using built-in mechanisms: adding themselves to groups (net localgroup administrators), modifying ACLs, requesting Kerberos tickets for SPNs (Kerberoasting with native .NET, no Rubeus needed), or finding credentials in GPP/SYSVOL. No Mimikatz, no hash dump, just native Windows functionality. HOST: T1558.003 Kerberoasting · HOST: Privilege Escalation
8. 8. Check for persistence via legitimate mechanisms No implant, no rootkit, no registry Run key. LOTL persistence is: a new VPN user, an added SSH authorized_key, a scheduled task that runs a legitimate binary with attacker-controlled arguments, or simply maintaining valid credentials that are never rotated. Check for new accounts, new group memberships, new scheduled tasks, and new SSH keys that appeared during the suspicious window. HOST: T1098.004 SSH Keys · HOST: T1053.003 Cron · Security EID 4720/4732
9. 9. Check for anti-forensic cleanup LOTL operators who are aware of logging will clear their traces using built-in tools: wevtutil cl (Windows event logs), history -c or unset HISTFILE (bash history), del on staging directories. The cleanup itself is detectable if logging captures the cleanup commands before they take effect. HOST: T1070.001 Clear Event Logs · HOST: T1070.003 Clear History
10. 10. Build the circumstantial case You will not find a binary to submit to a sandbox. You will not find a C2 IP to block. What you have is: an account that deviated from its baseline, ran a structured enumeration sequence, accessed resources it doesn't normally touch, possibly escalated privileges through native mechanisms, and possibly staged or moved data using built-in tools. The totality of the deviation IS the evidence. Document the timeline, the baseline comparison, and each anomaly.

It's LOTL if: The commands are individually legitimate but the sequence matches a known enumeration or attack pattern, the account's behavior deviates from its 30-60 day baseline, the session originates from an unusual source, and there is no IT change ticket or administrative justification for the activity.

It's NOT LOTL if: The user can explain the activity (IT troubleshooting, new software setup), the commands match the user's normal work pattern, the session comes from the user's normal workstation at their normal working hours, or IT confirms the activity was authorized.

The gray zone: Sometimes you can't confirm or rule out. The activity is unusual but not impossible for a legitimate user. In this case, increase monitoring on the account (enable verbose logging, add to a watchlist), notify the user's manager to confirm the activity, and check whether the credentials are exposed in any breach databases or infostealer logs.

Volt Typhoon is the defining LOTL actor. CISA's 2024 advisory documented their operations on US critical infrastructure using nothing but valid credentials and built-in tools, with multi-year dwell times. No malware was ever deployed. Detection came from behavioral anomalies in authentication logs and command patterns.

APT29 increasingly operates in LOTL mode post-initial-access, particularly in cloud environments where they use native Azure/M365 admin tools rather than deploying implants. Their cloud operations are almost entirely credential-based.

Scattered Spider (UNC3944) combines social engineering (help desk calls for MFA resets) with pure credential abuse. Post-access, they use RMM tools and native admin utilities. No custom malware. They target identity providers specifically to maximize the value of stolen credentials.

Ransomware pre-staging increasingly uses LOTL techniques in the early reconnaissance phase before deploying tools. The discovery and credential access phases look like normal admin activity; the ransomware-specific tooling only appears in the final hours.